Skip to content

Back to the catalog

Reverse Engineering the Six Stages of MacSync Stealer and RAT
huntress.comwriteup

Reverse Engineering the Six Stages of MacSync Stealer and RAT

Huntress reverse-engineers MacSync, a macOS stealer-and-RAT chain delivered via a weaponised claude.ai share link promoted through Google Ads malvertising, where a victim searching for how to install Claude on a Mac pastes a curl piped to zsh one-liner. The writeup traces all six stages: a polymorphic zsh loader, a server-side AppleScript that social-engineers Full Disk Access and validates the account password via dscl authonly, keychain and browser Safe Storage theft, a statically-linked C++ Mach-O RAT with WebSocket and AES-CBC C2 plus LaunchAgent persistence disguised as legitimate updaters, a signed Screen Recording-badged helper that phishes the TCC screen-capture permission, and trojanised Electron wallet apps (Ledger Live and Ledger Wallet) that inject a fake recovery-phrase phishing flow. It ties the kit to the AMOS and Atomic Stealer lineage via Russian-language code comments and shared infrastructure, and documents concrete IOCs including domains, C2 IP, mutex naming, and plist patterns for defenders.

TL;DR Huntress tears down MacSync, a six-stage macOS stealer/RAT delivered through a fake Claude install guide on a weaponised claude.ai share promoted via Google Ads malvertising.
Open original ↗
Document

What it is

Huntress's teardown of the initial-access chain for MacSync, a six-stage macOS stealer/RAT investigated in mid-July. The value beyond the summary is the delivery mechanism and the one concrete hunting indicator the post exposes: Google Ads campaign ID gad_campaignid=23991223358, which every victim of this buy carries in their browser history.

How it works

The lure is a paid Google Ads placement ranked above the organic anthropic.com result for searches like "how to install Claude Code on a Mac" — malvertising, not an exploit. The click's fingerprint is diagnostic:

flowchart TD
  S[Google search: install Claude on Mac] --> A{Which result?}
  A -->|Organic| O[anthropic.com direct, no aclk, no gclid]
  A -->|Sponsored| C[Google aclk redirect: gclid + gad_campaignid=23991223358]
  C --> P["claude.ai/share/<id> over HTTPS, Anthropic cert"]
  P --> B[Badged 'Shared by Apple Support']
  B --> T[Step: paste curl one-liner into Terminal]
  T --> L[Loader from attacker infra → 6-stage MacSync]

The lure page is a genuine public Claude share (claude.ai/share/<id>) — a feature any user can publish to. It rides Anthropic's real domain and certificate, so there is no lookalike domain or TLS warning. The operator set the display name to "Apple Support," and Anthropic's own safety banner echoes it back verbatim ("This is a copy of a chat between Claude and Apple Support"), lending the fake attacker-chosen name platform authority.

Preconditions / Affected

macOS users who search for Claude installation, click a sponsored result, and are willing to paste a curl one-liner into Terminal. No software vulnerability is involved — this is entirely social engineering over a trusted domain.

What to do

  • Hunt browser history for the ad-click signature: the aclk redirect hop, a gclid, and specifically gad_campaignid=23991223358. Any host carrying that campaign ID walked in through the same buy. Organic clicks leave none of these.
  • Flag or investigate claude.ai/share/<id> visits that precede Terminal activity, and any curl-piped-to-shell execution shortly after.
  • Treat AI-vendor "install guides" reached via sponsored results as untrusted; the real install path is the organic vendor domain, not a shared chat page.

Caveats

The post notes a weaponized share is publicly indexable and can be reached with no ad at all — search engines already surface claude.ai/share pages — so the campaign ID identifies this buy but not all victims of the technique. Huntress could not pull the malware from the victim's disk (host taken offline) and instead recovered it from the attacker's delivery servers. The fetched text cuts off mid-sentence at the Terminal step, so the exact curl command is not reproduced here.

Technologies named here

Techniques named here

  • Malvertising via sponsored search ads
  • Abuse of legitimate platform sharing feature
  • User-executed curl|zsh one-liner
  • Base64/gzip payload obfuscation
  • In-memory/fileless execution
  • TCC / Full Disk Access social engineering
  • ~/.zshrc persistence for permission re-trigger
  • Password phishing with validation oracle
  • Keychain and browser Safe Storage key theft
  • Broad credential/data harvesting
  • Anti-forensic cleanup
  • Chunked HTTP exfiltration with retry/backoff
  • LaunchAgent persistence with masquerading
  • Static linking of TLS stack for host-independent C2
  • String obfuscation via single-byte XOR
  • Encrypted WebSocket C2 channel
  • Full interactive remote shell
  • TCC permission theft via disguised helper app
  • Code-identity re-signing to preserve TCC grants
  • Trojanising trusted local applications
  • Fake in-app recovery phishing flow

Threat actors named here

Related in Malware & RE